CVE-2026-111615: Authorization Bypass Through User-Controlled Key in gz-yami mall4cloud

Mall4cloud versions up to and including 4.0 contain an insecure direct object reference vulnerability that permits authenticated merchants to bypass authorization controls. By enumerating auto-incremented orderAddrId values in the GET /m/order/order_addr/{orderAddrId} endpoint, attackers can access sensitive shipping address information belonging to buyers of other shops on the platform. This vulnerability arises from insufficient access control checks in the multishop OrderController getOrderAddr handler.

The vulnerability allows authenticated merchants to access personally identifiable information (PII) of buyers from other shops, including consignee names, mobile phone numbers, shipping addresses, and postal codes. This exposure of sensitive customer data can lead to privacy violations and potential misuse of the information. There is no indication of remote unauthenticated exploitation or privilege escalation beyond the authenticated merchant role.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict merchant access to only their own data where possible and monitor for unusual access patterns. Avoid exposing predictable identifiers in URLs that can be enumerated. Follow vendor updates closely for an official fix.